Subject: [saag] Internet Draft: draft-boesch-idxp-idpef-00.txt: Standardized Parameterization of Intrusion Detection Entities (IDPEF)

From: "B.-C. Boesch" <[email-masked]>
Date: Wed, 28 Jan 2015 21:17:23 +0100

Dear Community,

Efficiency of Intrusion Detection Systems (IDS) depends on their 
configuration and coverage of services. The coverage depends on used IDS 
with currently vendor-specific configurations. In case of usage of 
multiple systems the operations could become complex. Individual 
Communication between management interface and the IDS entities results 
that current multi-vendor IDS architectures do not interact with each 
other. They are independent coexistent.

The Internet Draft defines data formats and exchange procedures to 
standardize parametrization information exchange into intrusion 
detection and response systems from a Manager to an Analyzer.

The created Intrusion Detection Parametrization Exchange Format (IDPEF) 
is intended to be a standard data format to parametrize IDS. The 
development of this open standardized format and the Intrusion Detection 
Message Exchange Format (IDMEF) will be enable in combination 
interoperability among commercial, open source, and research systems, 
allowing users to mix-and-match the deployment of these systems 
according to their strong and weak points to obtain an optimal IDS 
implementation.

The most obvious place to implement IDPEF is in the data channel between 
a Manager and an Analyzer of an IDS within this data channel where the 
Manager sends the configuration parameters to the Analyzers. But there 
are other places where the IDPEF can be useful:

- Combination of specialized IDS like application-IDS with server-IDS, 
WLAN-IDS and network-IDS to one functional interacting meta-IDS.

- Management of different IDS vendors with one central management 
interface.

- Interaction of different IDS by using IDPEF and IDMEF.

- Parametrization backups and restore of parametrized IDS entities.

- For a communication between a Manager and a Manager in a multi-stage 
management architecture.

I am happy to invite you to give me feedback, suggestions, notations, 
hints, recommendations, etc. to improve the Internet Draft. Also 
comments to the purpose or intention of the format are welcome. The 
initial version of the Internet Draft could be found at:

http://www.ietf.org/id/draft-boesch-idxp-idpef-00.txt

I looking forward to a lively discussion.
Kind regards,

B.-C. Boesch